CVE-2026-64501

Summary of CVE-2026-64501 (Linux kernel, iio: adc: ad_sigma_delta) Multiple vendor advisories describe a vulnerability where CS (chip-select) could remain asserted and state leaks during SPI transfers in ad_sigma_delta_single_conversion and related error paths. The fixes move set_mode(AD_SD_MODE_...

CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

EUVD-2026-48838

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

CVE-2026-64494 iio: light: gp2ap002: fix runtime PM leak on read error

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

CVE-2026-64461 PCI: mediatek: Fix IRQ domain leak when port fails to enable

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port structure. However, the IRQ domains set up earlier by...

EUVD-2026-48805

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port structure. However, the IRQ domains set up earlier by...

CVE-2026-64461

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port structure. However, the IRQ domains set up earlier by...

CVE-2026-64461 PCI: mediatek: Fix IRQ domain leak when port fails to enable

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port structure. However, the IRQ domains set up earlier by...

EUVD-2026-48796

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

EUVD-2026-48914

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64365 HID: letsketch: fix UAF on inrange_timer at driver unbind

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

CVE-2026-64301 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

CVE-2026-64301 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

EUVD-2026-49013

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...